Vulnerability · Published Apr 28, 2026 · Assigned by VulDB

CVE-2026-7223BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery

High 7.3

In plain English

A high-severity server-side request forgery in HyperChat from BigSweetPotatoStudio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the function fetch of the file packages/core/src/http/aiProxyMiddleware.mts of the component AI Proxy Middleware. Such manipulation of the argument baseurl leads to server-side request forgery. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@dadigua/hyperchat	no fix listed	GHSA-r2jq-4h3x-rfj6

Affected products (as reported)

Vendor	Product	Versions
BigSweetPotatoStudio	HyperChat	2.0.0-alpha.02.0.0-alpha.12.0.0-alpha.22.0.0-alpha.32.0.0-alpha.42.0.0-alpha.52.0.0-alpha.62.0.0-alpha.7

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-359823 | BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery vdb-entry, technical-description
VDB-359823 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #802265 | BigSweetPotatoStudio HyperChat 2.0.0-alpha.63 Server-Side Request Forgery third-party-advisory
https://github.com/BigSweetPotatoStudio/HyperChat/issues/142 exploit, issue-tracking
https://github.com/BigSweetPotatoStudio/HyperChat/ product